ANS-C01 Network Security, Compliance and Governance Practice Question
A company's security team is investigating a potential data exfiltration incident. They notice that an EC2 instance in a private subnet is making HTTPS connections to an unknown external IP address. The instance's security group only allows outbound HTTPS to a specific set of IPs. What is the MOST likely cause of the traffic?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The instance is routing traffic through a NAT Gateway that has a route to the internet
A NAT Gateway in a public subnet can allow outbound traffic to any destination, bypassing security group restrictions if the security group allows traffic to the NAT Gateway. Option B is wrong because security groups are stateful; outbound rules apply regardless. Option C is wrong because an Internet Gateway is not in a private subnet. Option D is wrong because a VPC Endpoint is for AWS services, not external IPs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The instance is routing traffic through a NAT Gateway that has a route to the internet
Why this is correct
The security group allows outbound HTTPS to certain IPs, but if the traffic goes through a NAT Gateway, the destination IP seen by the security group is the NAT Gateway's IP, not the final destination.
- ✗
The instance is using a VPC Endpoint to connect to the external IP
Why it's wrong here
VPC Endpoints only connect to AWS services, not external IPs.
- ✗
The security group outbound rules are being overridden by a Network ACL
Why it's wrong here
Network ACLs can override, but they are stateless and would affect both inbound/outbound; security groups are still evaluated.
- ✗
The instance has a public IP address and is using an Internet Gateway directly
Why it's wrong here
The instance is in a private subnet, so it cannot have a public IP.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with a public subnet containing a NAT gateway and a private subnet containing EC2 instances. The EC2 instances need to download patches from the internet. The security team wants to ensure that the EC2 instances cannot initiate outbound connections to any other internet destinations. What should the network engineer do?
easy- A.Remove the NAT gateway and attach an Internet Gateway to the private subnet route table.
- B.Attach an egress-only Internet Gateway to the VPC and route private subnet traffic to it.
- C.Configure a network ACL on the private subnet to allow outbound traffic only to the patch server's IP address.
- ✓ D.Assign a security group to the EC2 instances that allows outbound HTTPS traffic only to the patch server's IP address.
Why D: Security groups act as a virtual firewall for EC2 instances, allowing you to specify outbound rules that restrict traffic to only the necessary destinations, such as the patch server's IP address on HTTPS. This provides granular control over outbound traffic. Option A is incorrect because removing the NAT gateway and attaching an internet gateway to the private subnet would give instances direct internet access, violating the restriction. Option B is incorrect because an egress-only internet gateway is used for IPv6 traffic only, not IPv4. Option C is incorrect because network ACLs are stateless and apply to the subnet as a whole, making them less suitable for per-instance granular control; they also require rules for return traffic, complicating the configuration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.